CVE-2026-11476: Student Management System Auth Bypass

CVE-2026-11476 is an authorization bypass vulnerability in Kushan2k student-management-system affecting the Profile Update Endpoint. Attackers can exploit improper authorization controls remotely. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-11476 Overview

CVE-2026-11476 is an improper authorization vulnerability [CWE-266] in the Kushan2k student-management-system project up to commit f16a4ceaddd6729c4b306ed4641cda3176c1ef2a. The flaw resides in the edit-admin function of controllers/AdminController.php, which handles the Profile Update endpoint. An authenticated remote attacker can manipulate the isadmin argument to elevate their privileges. The exploit has been disclosed publicly. Because the project follows a rolling release model, no fixed version identifiers are provided, and the maintainer has not yet responded to the issue report.

Critical Impact
Authenticated users can tamper with the isadmin parameter during profile updates to grant themselves administrative privileges over the application.

Affected Products

Kushan2k student-management-system (rolling release)
Commits up to and including f16a4ceaddd6729c4b306ed4641cda3176c1ef2a
Component: Profile Update Endpoint (controllers/AdminController.php)

Discovery Timeline

2026-06-08 - CVE-2026-11476 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11476

Vulnerability Analysis

The vulnerability is an improper authorization weakness [CWE-266] in the edit-admin function of controllers/AdminController.php. The Profile Update endpoint accepts an isadmin argument from the client without validating whether the requesting user is permitted to modify that attribute. An authenticated low-privilege user can submit a crafted profile update request that sets isadmin to a truthy value, escalating the account to administrator. The vulnerability is reachable remotely over the network, requires only standard user privileges, and does not require user interaction. The EPSS score is 0.043% (13.4 percentile), reflecting limited observed exploitation despite the public disclosure.

Root Cause

The root cause is mass assignment combined with missing authorization checks on a privileged attribute. The edit-admin handler binds user-supplied input directly to the user record without filtering the isadmin field. There is no server-side check confirming that the caller already holds administrative rights before persisting the change.

Attack Vector

An attacker with a valid low-privilege account sends an HTTP request to the Profile Update endpoint that includes an isadmin field set to 1 or true. The server persists the value to the user's record, and the account is treated as administrative on the next privilege check. From there, the attacker gains access to administrative functionality within the application.

No verified proof-of-concept code has been published in the referenced advisories. Refer to the VulDB Vulnerability Report and the GitHub Issue Tracker Entry for additional technical detail.

Detection Methods for CVE-2026-11476

Indicators of Compromise

HTTP POST or PUT requests to the profile update route containing an isadmin parameter from non-administrative sessions.
Database audit entries showing isadmin flipping from 0 to 1 outside of legitimate admin provisioning workflows.
Unexpected appearance of standard accounts in administrative views or audit logs.

Detection Strategies

Instrument the edit-admin handler to log every profile update payload, including all submitted field names, and alert on requests carrying privileged attributes.
Compare pre- and post-update user records during profile saves and raise an event when the role or isadmin flag changes.
Add web application firewall (WAF) rules that inspect request bodies to the profile endpoint for an isadmin parameter.

Monitoring Recommendations

Continuously monitor authentication and authorization logs for accounts that suddenly gain administrative actions after a profile edit.
Track changes to user role columns in the database and forward events to a centralized log store for correlation.
Review web server access logs for repeated requests to the profile update route from the same low-privilege session.

How to Mitigate CVE-2026-11476

Immediate Actions Required

Audit all user accounts and revoke administrative privileges that were not provisioned through an approved workflow.
Restrict access to the application until the edit-admin handler enforces server-side authorization on the isadmin field.
Remove isadmin from any list of fields accepted during user-initiated profile updates and reject the parameter at the controller layer.

Patch Information

No official patch has been released. The project follows a rolling release model and, according to the advisory, the maintainer has not responded to the GitHub Issue Tracker Entry. Track the GitHub Project Repository for fixes and consult the VulDB CVE-2026-11476 entry for updates.

Workarounds

Implement an allowlist of editable fields in controllers/AdminController.php and exclude isadmin and any other role attributes from user-controlled input.
Add an explicit authorization check that confirms the session belongs to an existing administrator before any modification of isadmin is committed.
Place the application behind a reverse proxy or WAF that drops requests containing an isadmin parameter on the profile update route.

bash

# Example WAF rule (ModSecurity) to block isadmin tampering on profile updates
SecRule REQUEST_URI "@beginsWith /edit-admin" \
    "id:1026011476,phase:2,deny,status:403,\
     msg:'CVE-2026-11476 isadmin parameter blocked',\
     chain"
    SecRule ARGS_NAMES "@streq isadmin" "t:lowercase"